Penetration testing services

A vulnerability assessment identifies and prioritizes potential weaknesses. A penetration test investigates exploitability and impact within an authorized scope. A scan can support the assessment, but it does not establish how an application workflow or a chain of weaknesses can be abused.

We agree the access model during scoping. Black box testing starts with limited information; grey box testing uses access such as user accounts; white box testing can include source code and architecture details. The right approach depends on the question the assessment needs to answer.

Yes. Share the evidence request before testing so we can agree the scope and reporting expectations. A penetration test contributes technical evidence. It does not certify an organization or guarantee an audit outcome.

Your proposal specifies whether retesting is included in the price, the findings covered, the number of rounds, and the time window. We check fixes against the original findings and record the results. New functionality or substantial environment changes require a scope review.

Keep using your scanner. A pentest adds investigation of how your application is meant to work and how someone could misuse it. We test the agreed roles, business logic, and attack paths, then validate the impact. Scanner results can inform that work; the report needs evidence behind the findings.

Before testing, we need help with access, test accounts, and the intended behavior of the system. Afterward, your team receives reproduction steps and remediation guidance for the findings. A findings review gives the engineers responsible for fixes a chance to work through the evidence and priorities with us.

Bring the previous report and a list of changes to your code, permissions, or infrastructure. We can use those to scope the next assessment. Check which earlier findings were fixed and which fixes were verified; the date on the old report does not answer those questions.